Abandoned Cart Pro for WooCommerce: Unauthenticated SQL injection in guest cart
Summary
The WordPress plugin Abandoned Cart Pro for WooCommerce contains an unauthenticated SQL injection in the guest persistent cart handling. The injected value comes from checkout fields that an attacker controls, such as an SMS consent field, and is concatenated into an UPDATE query on the WordPress user meta table. An attacker can extract database content through time-based blind techniques and, as demonstrated, can gain administrator rights on the site. The attack requires no account and no user interaction.
Affected
- Abandoned Cart Pro for WooCommerce up to and including 10.8.0
Fixed in
- Version 10.8.1 (vendor changelog, release date 8 October 2026)
Workaround
Unknown.
Exploitation
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- No public proof of concept confirmed in the research.
- VulnCheck KEV lists the CVE (16 October 2026). This is not a CISA KEV listing, and the CISA KEV status was not verified.
Our recommendation
- Check whether Abandoned Cart Pro for WooCommerce is installed and which version is active on each WooCommerce site.
- Update to version 10.8.1 or later. The same release also fixes CVE-2026-102251 and an authentication bypass.
- If an update is not possible right away, deactivate the plugin until it can be updated.
- Check for unexpected administrator accounts and changed user capability entries.
- Review logs for unusual checkout requests and long-running database queries.
- If compromise is suspected, restore from a clean backup and assess data protection obligations (nDSG/GDPR).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor changelog www.tychesoftwares.com
- Wordfence advisory www.wordfence.com
- CVE record via aggregator cve.threatint.com
- Strix CVE details www.strix.ai
- VulnCheck KEV entry (Vulners) vulners.com
- CVELIST record (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:05.
Original description (NVD)
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the update_guest_persistent_cart() function. The abandoned_cart_info value, populated from attacker-controlled checkout fields such as the SMS consent field, is passed through stripslashes() and concatenated directly into an UPDATE statement while the adjacent SELECT and INSERT use prepared statements. This makes it possible for unauthenticated attackers to append additional SQL to the query. Because the sink is an UPDATE ... SET on the wp_usermeta table, the injection can both extract sensitive information from the database via time-based blind techniques and modify usermeta rows; it has been demonstrated to escalate an arbitrary account to administrator by writing a wp_capabilities row that shadows the legitimate one.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.